Evolutionary Feature Reduction and Edge-Optimized CNN Inference for Large-Scale IoT DDoS Detection
TL;DR
The proposed evolutionary feature reduction and edge-optimized CNN framework provides an effective and deployment-ready solution for real-time large-scale IoT DDoS detection, making it suitable for practical intrusion detection deployment in production IoT gateway environments.
Abstract
The rapid proliferation of Internet of Things (IoT) deployments has introduced significant security vulnerabilities, particularly due to Distributed Denial-of-Service (DDoS) attacks launched through compromised IoT botnets. Real-time detection of such attacks at the network edge remains challenging because of high feature dimensionality, severe class imbalance between benign and attack traffic, and strict latency constraints of resource-constrained IoT gateways. This paper aims to design and evaluate a unified framework for large-scale IoT DDoS detection that reduces feature dimensionality, improves classification performance under imbalanced conditions, and enables low-latency edge deployment suitable for real-time gateway environments. The proposed framework employs a multi-phase pipeline integrating evolutionary feature reduction, deep learning classification, and edge-optimized deployment. A Weighted Genetic Algorithm (W-GA) is used to select a compact and importance-ranked subset of discriminative features from the original high-dimensional representation. A one-dimensional Convolutional Neural Network (CNN) is then trained on the feature set with reduced weights to capture the characteristic of local co-occurrence patterns of volumetric DDoS traffic. Finally, the trained model is exported and deployed using ONNX Runtime for efficient inference on IoT gateway hardware. Experimental evaluation on the CIC-IoT-2023 dataset demonstrates that the proposed W-GA+CNN framework consistently outperforms baseline classifiers in terms of classification effectiveness and inference throughput while maintaining sub-millisecond edge inference latency. The proposed evolutionary feature reduction and edge-optimized CNN framework provides an effective and deployment-ready solution for real-time large-scale IoT DDoS detection, making it suitable for practical intrusion detection deployment in production IoT gateway environments.